Splunk Search

Splunk query- How to use spath command for the below logs?

uagraw01
Motivator

How to use spath command for the below logs i have attached in the screenshot.

IMG_20220512_184747__01__01.jpg

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I forgot you need to deal with multiline values

| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Error log: (?<json>\{.*\})"
| spath input=json
0 Karma

uagraw01
Motivator

@ITWhisperer Thanks for your reply but it is Not working for me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you getting in the json field?

0 Karma

uagraw01
Motivator

@ITWhisperer I have tried this and now it is working fine.

IMG_20220512_195036__01.jpg

0 Karma

uagraw01
Motivator

@ITWhisperer  I think rex is not properly working.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I forgot you need to deal with multiline values

| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...